Enforcement, penalties and application timeline

Penalty tiers

The AI Act establishes three tiers of administrative fines, each tied to a distinct category of infringement. Member States are required to lay down the specific penalty rules and notify the Commission by the date of entry into application; those rules must be effective, proportionate and dissuasive, and must take into account the interests of SMEs, including start-ups, and their economic viability 32024R1689 Article 99@2024-06-13.

Tier 1 — Prohibited practices (Article 5): Non-compliance with the prohibitions on unacceptable-risk AI attracts fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher 32024R1689 Article 99@2024-06-13.

Tier 2 — Operator and notified body obligations: Non-compliance with provider, authorised representative, importer, distributor, deployer, and notified body obligations — and with transparency obligations under Article 50 — is subject to fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 3% of worldwide annual turnover for the preceding financial year, whichever is higher 32024R1689 Article 99@2024-06-13.

Tier 3 — Misleading information to authorities: Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request attracts fines of up to EUR 7 500 000 or, if the offender is an undertaking, up to 1% of worldwide annual turnover for the preceding financial year, whichever is higher 32024R1689 Article 99@2024-06-13.

For SMEs and start-ups, each fine is capped at whichever of the relevant percentage or absolute amount is lower 32024R1689 Article 99@2024-06-13.

Discretionary factors in fine-setting: When deciding whether to impose a fine and on its amount, authorities must weigh all relevant circumstances — including the nature, gravity, duration and consequences of the infringement; the number of affected persons and their level of harm; financial benefits or losses avoided; the degree of cooperation shown; whether the infringement was intentional or negligent; and prior fines imposed by other market surveillance authorities for the same infringement 32024R1689 Article 99@2024-06-13. Member States determine how fines apply to public authorities within their territory, may route fine decisions through courts, and must report annually to the Commission on fines issued 32024R1689 Article 99@2024-06-13.

Application timeline

The Regulation's general date of application is 2 August 2026, but duties bite in four distinct waves 32024R1689 Article 113@2024-06-13:

| Date | What applies | |---|---| | 2 February 2025 | Chapters I and II — general provisions and the prohibited AI practices (Article 5) | | 2 August 2025 | Chapter III Section 4 (notified bodies), Chapter V (general-purpose AI models), Chapter VII and Chapter XII, and Article 78 — with the exception of Article 101 | | 2 August 2026 | General application — high-risk requirements, conformity assessment, market surveillance, penalties | | 2 August 2027 | Article 6(1) and corresponding obligations — high-risk AI systems that are safety components of products covered by Annex I Union harmonisation legislation |

Grandfathering and transitional arrangements

Systems already on the market before the general application dates are not immediately required to comply in full. Three windows apply 32024R1689 Article 111@2024-06-13:

1. Annex X large-scale IT systems placed on the market or put into service before 2 August 2027 must be brought into compliance by 31 December 2030 32024R1689 Article 111@2024-06-13.

2. Other high-risk AI systems placed on the market or put into service before 2 August 2026 fall outside scope unless they undergo significant changes in design from that date onward. Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 regardless 32024R1689 Article 111@2024-06-13.

3. GPAI model providers whose models were placed on the market before 2 August 2025 must take the necessary steps to comply with GPAI obligations by 2 August 2027 32024R1689 Article 111@2024-06-13.

One hard limit cuts across all three windows: the prohibition on unacceptable-risk practices under Article 5 is explicitly excluded from grandfathering and applied from 2 February 2025, irrespective of when a system was placed on the market 32024R1689 Article 111@2024-06-13 32024R1689 Article 113@2024-06-13.

This block connects to your organisation's own AI governance policy. In the full product it shows, cited to your policy, how YOUR organisation implements the regulation above — private to your organisation. (Demo placeholder.)

The following are labeled illustrative context, not regulation. No recent enforcement cases are cached for this topic.